Questions tagged [tcpdump]

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

121 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
1 answer
846 views

Finding google unusual traffic

We are a small Internet provider. In order to get Internet access we are using NAT (10-20 users per one public IP). And lately we've met with Google blocking services (captcha and full block) and we ...
Alex's user avatar
  • 231
3 votes
0 answers
649 views

TCP retransmission inside of docker network

Just lately our server started experiencing increased CPU usage by the php(Symfony) and mysql processes. For quite some time we been trying to find the cause and we found out that we have big amount ...
Maarduk's user avatar
  • 133
3 votes
0 answers
944 views

TCP Window Scaling Not Working Between Windows 10 and Linux Server

We are having some issues with several clients running Windows 10 downloading files from our HTTP file delivery server. We can't reproduce the error on our end but notice that TCP window scaling is ...
Ted Wilmont's user avatar
3 votes
0 answers
517 views

Is it possible to capture traffic on host when using KVM passthrough?

I have a KVM guest which uses PCI passthrough for its network interfaces: <hostdev mode='subsystem' type='pci' managed='yes'> <source> <address domain='0x0000' bus='0x05' slot='...
Evan's user avatar
  • 131
3 votes
0 answers
2k views

how to use tcpdump on interface with link down

A set of daemon applications communicating over UDP broadcasts on the same machine give me trouble capturing their traffic. The network interface is eth0, it's configured to a static IP and there's no ...
LeSpocky's user avatar
  • 131
3 votes
1 answer
335 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
dubmojo's user avatar
  • 203
2 votes
0 answers
156 views

Long latency to reply a TCP ACK

k8s environment(4 nodes, rke 1.21.5) We noticed there is randomly significant latency in socket data transferring between different k8s pods. Latency could be as long as 15 seconds in some cases. By ...
skyfire's user avatar
  • 21
2 votes
0 answers
4k views

How to figure out what is bad about a 400 bad request, on an Apache-server

The overarching question How do I see what is 'bad' about a 400 - bad request? Info about the error When I click around the WordPress-backend, then between 3 and 7 requests (out of 95-100) give me a:...
Zeth's user avatar
  • 131
2 votes
0 answers
2k views

tcpdump: invalid cksum from client to localhost interface even after disabling offloading

I'm having a strange issue. In linux I have two windows open. one running tcpdump and one running curl. I used curl to try to make a connection to local host and tcpdump logs invalid checksum errors. ...
Mike's user avatar
  • 21
2 votes
1 answer
2k views

Analyzing traffic by tcpdump between HAProxy server and mariadb

I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results: 23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
user3637971's user avatar
2 votes
0 answers
9k views

Why TCP Out-Of-Order packet is seen after SYN?

I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior. ...
Vignesh Ramanan's user avatar
2 votes
0 answers
718 views

Tap interface is not receiving packets

I'm configuring a tap interface and trying to send and receive packets through it, i configure it like this: ip tuntap add name tap0 mode tap multi_queue ip link set tap0 up i'm using scapy to send ...
Kareem Khaleel's user avatar
2 votes
0 answers
3k views

How to measure latency using wireshark

I'm trying to measure the wire-to-wire latency of a blackbox application. The application engages in tcp offloading (kernel bypass), it consumes incoming UDP packets via a NIC and in response, ...
user2635088's user avatar
2 votes
0 answers
645 views

Xen networking - dom0 receives ARP requests but no reachability

Both dom0 and domU are Debian 8. Dom0 network configuration is: auto xenbr0 iface xenbr0 inet manual bridge_ports eth1 bridge_stp off bridge_waitport 0 bridge_fd 0 auto xenbr0.4 ...
user avatar
2 votes
1 answer
137 views

Network interface reading traffic from 2 different hosts

Situation: Server A is receiving network traffic sent from server B to server C. Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this ...
Johan Kooijman's user avatar
2 votes
0 answers
2k views

How to know the source of certain TCP traffic on AIX

We have two AIX boxes, one for production system and another for testing. both systems are running ATM machine switches, where the ATM device is connected via TCP socket. we had an issue on ...
A.Rashad's user avatar
  • 293
1 vote
1 answer
169 views

IPv6 port scanners hang after scanning a closed port

I am testing nftables firewall rules using two virtual machines, one with the active firewall and one that tries to connect to it. For example with netcat and no firewall: nc -6 fe80::9d08:b3e2:47fa:...
stmas's user avatar
  • 11
1 vote
0 answers
315 views

What is the key file for ssldump?

I search google for a tool to decode https traffic and get the ssldump with examples like: ssldump -k xxx.pem -i eth0 -d host example.com I wonder what the key file xxx.pem is. On the server hosting ...
peter's user avatar
  • 123
1 vote
0 answers
191 views

Why is TCP doing RTO based retransmits (200ms+ wait) vs other fast-retransmission mechanisms?

(Trying this forum after the question was deemed off-topic for Stack Overflow & Network Engineering) I am investigating an issue where we see occasional 200ms+ spikes in a simple tcp client/server ...
RandomQuestion's user avatar
1 vote
0 answers
592 views

dhcp-relay cannot recieve DHCPOFFER packet from DHCP server in shared network

I'm using the dnsmasq service as a DHCP server. I have a bridged interface per node named br0 that has two ip addresses assigned to it. One is the public IP address and the other one is considered the ...
Mohammadreza Nasrabadi's user avatar
1 vote
0 answers
1k views

tcpdump: filtering out localhost, packets show up anyway?

I'm trying to use tcpdump to explore what on my computer talks with whom on the world wide web. I've came this far as of yet: lan_hosts="(hosts || to || exclude)" local_hosts="(127.0.0....
xogoxec344's user avatar
1 vote
0 answers
263 views

tcpdump not capturing packets but Apache log shows the request

I'm trying to debug a client side javascript application that sends a XMLHttpRequest to a php script but I don't get any output from tcpdump when this happens. Apache logs the request, the script ...
Version7's user avatar
1 vote
0 answers
57 views

Does tcpdump guarantee packet integrity?

In normal use of tcpdump without any parameter, does it guarantee? tcpdump -i eth0 -w file.pcap In using tcpdump rotating by time with -G parameter, does it guarantee? tcpdump -i eth0 -w file.pcap -...
hakansel05's user avatar
1 vote
0 answers
43 views

Network packets don't reach local host when connected with to Openstack VPS with Openvpn server

So here is an issue. I've installed OpenVPN server on Openstack VPS (hostigger, if this is important). I've used guide https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-...
St.Shadow's user avatar
  • 111
1 vote
0 answers
2k views

PowerDNS AXFR - ;; communications error to x.x.x.x#53: end of file

Using PowerDNS, we got into an issue with transferring a single domain object (/24) from our primary to our secondary DNS server. This /24 is part of a larger RIPE block, /22, and is not ...
Beeelze's user avatar
  • 161
1 vote
0 answers
268 views

Getting different local-port value in tcpdump when using --local-port option in curl

I'm using curl command to send the traffic to the Server. In curl command, I'm using --local-port option. Below is the command: curl -v --interface 10.1.1.3 -b --local-port 10000 http://30.1.1.101/...
metadata's user avatar
  • 121
1 vote
0 answers
31 views

No packet crossing default gateway

I have two Ubuntu 17.04 nodes, A (10.0.9.2) and B (10.0.9.1). I have set B as default gateway of A, using the command: route add default gw 10.0.9.1 interface vi4. Yet, when I traceroute 8.8.8.8 ...
defaultgw444's user avatar
1 vote
0 answers
224 views

Wifi interface drops all packets

I have a remote system connected via WiFi to the network. The wifi connection is established correctly and I can ping the gateway. The maintainer of the gateway (3rd party, not accessible for me) ...
DBX12's user avatar
  • 121
1 vote
1 answer
578 views

tcpdump - how to track the source of requests made with ephemeral/dynamic ports

I'm trying to identify the network traffic between multiple backend microservices running on the same server. (they make some rest http calls to each other) Unfortunately, when i use tcpdump, the ...
MikaelW's user avatar
  • 111
1 vote
0 answers
588 views

Suddenly cannot ssh into any machine

Suddenly I was not able to ssh to any machine. I thought it to be my router/network issue & I tried it with different network but the result was same. I took tcp dump on both server & client ...
Ishan Jain's user avatar
1 vote
1 answer
2k views

tcpdump cannot capture none-broadcast/multicast packets from bridge interface in OpenWRT

(Originally, I posted it on StackOverflow. I move it to networkengineering and then here.) I have TP-LINK WR841N v9 router and install OpenWRT firmware CHAOS CALMER (15.05.1, r48532). I have /etc/...
0xBADBOO's user avatar
1 vote
0 answers
1k views

How to capture http requests headers and body

need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body. I have found that tcpdump captures all the requests, but big ones end up being ...
Jonas Flesch's user avatar
1 vote
0 answers
57 views

VPS instance outbound traffic increasing linearly

I have a DigitalOcean VPS instance whose outbound traffic is behaving strangely, increasing linearly over a 7 day period. I'm trying to figure out what is going on through tcpdump, but to tell the ...
methodofaction's user avatar
1 vote
0 answers
517 views

Dump a tcp stream (tcpdump/tpick?) and save to file only if RST happen

I'm looking for a way to capture a whole tcp stream, but save it into the file only if 1) error happens (like RST) 2) not sure if possible - analyze the http response, store if HTTP 500 happen is a ...
sirkubax's user avatar
  • 121
1 vote
0 answers
719 views

Duplicate SYN package forwarded by Docker?

I'm experiencing a strange interaction between a CISCO firewall and my Docker host connected to it: the CISCO periodically marks my host as a SYN attacker and shuts my ethernet port down. I've been ...
Federico Bonelli's user avatar
1 vote
0 answers
369 views

Server socket sitting in FIN_WAIT_1 whilst network doesn't see its traffic

We've been trying to get a grip on a really weird problem where we can wget a page from Apache 2.2.19 on solaris 10 and some permutations of requests reliably take various fixed lengths of time to ...
Chris Phillips's user avatar
1 vote
0 answers
501 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
zafar_sust_bd's user avatar
1 vote
0 answers
231 views

Unusual Behavior with NIC Interrupt Moderation Disabled

OS: Centos7 I disabled interrupt moderation, ethtool -C eno2 rx-usecs 0, and then started capturing on that interface using tcpdump. The dump file was growing as expected. Maybe an hour later the ...
user3513346's user avatar
1 vote
1 answer
2k views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
sidorvm's user avatar
  • 11
1 vote
0 answers
127 views

An already acknowledged data sequence number is coming back as null byte repeatedly

There is a transaction processing server (TP-Server) to which my application (Client) connects to. We are seeing a strange packet sequence where in the TP-Server is sending a PUSH packet with a null (...
ReddyGB's user avatar
  • 11
1 vote
0 answers
3k views

Use tcpdump to find interface errors

I looking for what's causing dropped packets on an interface: RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0 TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0 I ...
nixstack's user avatar
1 vote
0 answers
849 views

Massively large number of packets dropped by interface

I have a virtual machine on ESXi 5 acting as a firewall for a PBX, it is running vyatta. When I run tcpdump on any interface, I get some ridiculous numbers! e.g. 4 packets captured 402 packets ...
metacom's user avatar
  • 306
1 vote
0 answers
619 views

tcpdump expression to show zero-byte ACKs?

I want to show zero-byte TCP keepalives sent and received. While this could be generally useful, in this particular case I want to prove that a change I made to the JDBC driver (adding tcpKeepAlive=...
Steve Kehlet's user avatar
  • 1,105
1 vote
2 answers
324 views

Server sending packets every 5 minutes to 3 IPs

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
Anthony Miller's user avatar
1 vote
0 answers
372 views

Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and "x dropped packets"

I am trying to capture about 15 Mbit of traffic on the loopback device on Ubuntu LTS using tcpdump, and I am seeing dropped packets. The CPU is a freaking i7, and i have yet to see CPU usage go above ...
Tarnay Kálmán's user avatar
1 vote
1 answer
2k views

How can I dump nginx requests for a specific location while nginx is secured?

I want to dump all request that nginx is getting for a specific location so I can debug a strange problem that I have. Usually tcpdump would be the solution but remember that nginx is accessed using ...
sorin's user avatar
  • 8,216
1 vote
0 answers
173 views

tcpdump strange udp line

I've found a strange line in the tcpdump output. Normally UDP packets are dumped in the following form: timestamp IP srcaddress.port > dstaddress.port: UDP, length packetlength but this is just: ...
Karoly Horvath's user avatar
1 vote
1 answer
300 views

TCP stops sending weirdly

In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
Utoah's user avatar
  • 291
1 vote
1 answer
546 views

tcpdump not giving details

Why does tcpdump not give my more details? Each time it only comes as - 16:22:26.128541 [|ether] # ./tcpdump -vv not port 22 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size ...
veccy's user avatar
  • 111
1 vote
1 answer
1k views

How to strip TCP headers from tcpdump (with hexadecimal output of non-printable data)

tcpdump don't know how to strip TCP headers from packed data. tcpflow print's only packet data, nice, but it supports only ASCII characters, no hexadecimal output possible. Did I overlooked some ...
David162795's user avatar